Index: root/xen-unstable.hg/tools/xm-test/lib/XmTestLib/XenDomain.py =================================================================== --- root.orig/xen-unstable.hg/tools/xm-test/lib/XmTestLib/XenDomain.py +++ root/xen-unstable.hg/tools/xm-test/lib/XmTestLib/XenDomain.py @@ -29,6 +29,7 @@ from Test import * from config import * from Console import * from XenDevice import * +from acm import * BLOCK_ROOT_DEV = "hda" @@ -103,7 +104,8 @@ class XenConfig: self.defaultOpts["vif"] = [] self.defaultOpts["vtpm"] = [] if isACMEnabled(): - self.defaultOpts["access_control"] = [] + #A default so every VM can start with ACM enabled + self.defaultOpts["access_control"] = ['policy=xm-test,label=red'] self.opts = self.defaultOpts @@ -131,6 +133,7 @@ class XenConfig: output = file(filename, "w") output.write(self.toString()) output.close() + ACMPrepareSystem(self.opts) def __str__(self): """When used as a string, we represent ourself by a config Index: root/xen-unstable.hg/tools/xm-test/lib/XmTestLib/block_utils.py =================================================================== --- root.orig/xen-unstable.hg/tools/xm-test/lib/XmTestLib/block_utils.py +++ root/xen-unstable.hg/tools/xm-test/lib/XmTestLib/block_utils.py @@ -6,6 +6,7 @@ import time from XmTestLib import * +from acm import * import xen.util.blkif @@ -26,6 +27,7 @@ def get_state(domain, devname): def block_attach(domain, phy, virt): + ACMLabelResource(phy) status, output = traceCommand("xm block-attach %s %s %s w" % (domain.getName(), phy, virt)) if status != 0: Index: root/xen-unstable.hg/tools/xm-test/lib/XmTestLib/acm.py =================================================================== --- root.orig/xen-unstable.hg/tools/xm-test/lib/XmTestLib/acm.py +++ root/xen-unstable.hg/tools/xm-test/lib/XmTestLib/acm.py @@ -26,7 +26,7 @@ except: ACM_LABEL_RESOURCES = False labeled_resources = {} -acm_verbose = False +acm_verbose = True def isACMEnabled(): return security.on() @@ -43,6 +43,17 @@ def ACMLoadPolicy(policy='xm-test'): "Start the system without any policy.\n%s" % (policy, o)) +def ACMPrepareSystem(resources): + if isACMEnabled(): + ACMLoadPolicy() + ACMLabelResources(resources) + +def ACMLabelResources(resources): + for k, v in resources.items(): + if k == "disk": + for vv in v: + res = vv.split(',')[0] + ACMLabelResource(res) # Applications may label resources explicitly by calling this function def ACMLabelResource(resource, label='red'): Index: root/xen-unstable.hg/tools/xm-test/runtest.sh =================================================================== --- root.orig/xen-unstable.hg/tools/xm-test/runtest.sh +++ root/xen-unstable.hg/tools/xm-test/runtest.sh @@ -197,6 +197,8 @@ run=yes unsafe=no GROUPENTERED=default +cp -f tests/security-acm/xm-test-security_policy.xml /etc/xen/acm-security/policies + # Resolve options while [ $# -gt 0 ] do Index: root/xen-unstable.hg/tools/xm-test/README =================================================================== --- root.orig/xen-unstable.hg/tools/xm-test/README +++ root/xen-unstable.hg/tools/xm-test/README @@ -125,8 +125,8 @@ following command from the xm-test direc Some of these tests will work even without support of ACM by Xen. -Several of these tests require the privilege of being allowed to label -resources and will otherwise be skipped. By default the test suite +The xm test suite has been extended to support labeling of resources +as required by the existing tests. However, by default the test suite is not allowed to automatically label resources since this may affect existing labels. To enable this, the test suite must be configured with the following parameter passed to the configure scripts (in addition to